domain.sh

#!/usr/bin/bash

clear
f_banner

echo -e "${BLUE}RECON${NC}"
echo
echo "1.  Passive"
echo "2.  Active"
echo "3.  Find registered domains"
echo "4.  Previous menu"
echo
echo -n "Choice: "
read recon

case $recon in
     1) $discover/passive.sh && exit;;

     2) $discover/active.sh && exit;;

     3)
     clear
     f_banner

     echo -e "${BLUE}Find registered domains.${NC}"
     echo
     echo 'Open a browser to https://www.reversewhois.io/'
     echo 'Enter your domain and solve the captcha.'
     echo 'Select all > copy all of the text and paste into a new file.'

     f_location
     echo
     grep '^[0-9]' $location | awk '{print $2}' | sort -u > tmp
     total=$(wc -l tmp | sed -e 's/^[ \t]*//' | cut -d ' ' -f1)

     while read regdomain; do
          ipaddr=$(dig +short $regdomain | egrep -v '(0.0.0.0|127.0.0.1|127.0.0.6)' | sed '/[a-z]/d')
          whois -H "$regdomain" | egrep -iv '(#|please query|personal data|redacted|whois|you agree)' | sed '/^$/d' > tmp2
          wait

          regemail=$(grep 'Registrant Email:' tmp2 | cut -d ' ' -f3 | tr 'A-Z' 'a-z')

          if [[ $regemail == *'abuse'* || $regemail == *'anonymize.com'* || $regemail == *'buydomains.com'* || $regemail == *'cloudflareregistrar.com'* || $regemail == *'contact-form'* || $regemail == *'contact.gandi.net'* || $regemail == *'csl-registrar.com'* || $regemail == *'domaindiscreet.com'* || $regemail == *'dynadot.com'* || $regemail == *'email'* || $regemail == *'gname.com'* || $regemail == *'google.com'* || $regemail == *'identity-protect.org'* || $regemail == *'meshdigital.com'* || $regemail == *'mydomainprovider.com'* || $regemail == *'myprivatename.com'* || $regemail == *'networksolutionsprivateregistration'* || $regemail == *'please'* || $regemail == *'p.o-w-o.info'* || $regemail == *'privacy'* || $regemail == *'Redacted'* || $regemail == *'redacted'* || $regemail == *'select'* || $regemail == *'tieredaccess.com'* ]]; then
               regemail=''
          fi

          regorg=$(grep 'Registrant Organization:' tmp2 | cut -d ':' -f2 | cut -d ' ' -f2- | sed 's/      //g; s/administration/Administration/g; s/Anonymize, Inc/Anonymize Inc/g; s/By /by /g; s/, Corp/ Corp/g; s/Data Protected//g; s/family/Family/g; s/Identity Protect Limited//g; s/Identity Protection Service//g; s/, Inc. / Inc/g; s/, Inc/ Inc/g; s/, Inc /Inc/g; s/Inc./Inc/g; s/INFORMATION SYSTEMS AND MANAGEMENT CONSLANTS/Information Systems and Management Consultants/g; s/INSTITUTE/Institute/g; s/, LLC/ LLC/g; s/MEMORIAL/Memorial/g; s/, N.A./ N.A./g; s/N\/A//g; s/Not Disclosed//g; s/None//g; s/NULL//g; s/ (NYHQ)//g; s/Redacted for privacy//g; s/S.L./SL/g; s/Statutory Masking Enabled//g; s/UNIVERSITY/University/g; s/(US) //g; s/WEST VIRGINIA/West Virginia/g')

          if [[ $regorg == *'Privacy'* || $regorg == *'PRIVACY'* ]]; then
               regorg=''
          fi

          registrar=$(grep 'Registrar:' tmp2 | cut -d ' ' -f2- | sed 's/Co.,/Co./g; s/Corp.,/Corp/g; s/Hongkong/Hong Kong/g; s/Identity Protection Service//g; s/Gransy,/Gransy/g; s/, Inc/ Inc/g; s/Inc./Inc/g; s/IncUSA/Inc/g; s/KEY-SYSTEMS/Key-Systems/g; s/Limited,/Ltd /g; s/, LLC/ LLC/g; s/Ltd./Ltd/g; s/, Ltd/ Ltd/g; s/MARKMONITOR/MarkMonitor/g; s/MarkMonitor./MarkMonitor /g; s/Registrar://g; s/REGISTRAR OF DOMAIN NAMES//g; s/s.l./SL/g; s/, S.L./SL/g; s/technologies/Technologies/g; s/technology/Technology/g; s/^[ \t]*//' | head -n1)

          if [[ $registrar == 'Domains' ]]; then
               registrar=''
          fi

          echo "$regdomain,$ipaddr,$regemail,$regorg,$registrar" | grep -v ',,,,' >> tmp3
          let number=number+1
          echo -ne "$number of $total domains"\\r
          sleep 2
     done < tmp

     echo 'Domain,IP Address,Registration Email,Registration Org,Registrar' > tmp4
     cat tmp4 tmp3 | grep -Ev '^\b([0-9]{1,3}\.){3}[0-9]{1,3}\b' | column -t -s ',' | sed 's/[ \t]*$//' > $home/data/registered-domains
     rm tmp*

     echo
     echo
     echo $medium
     echo
     echo '***Scan complete.***'
     echo
     echo
     echo -e "The report is located at ${YELLOW}$home/data/registered-domains${NC}\n"
     exit
     ;;

     4) f_main;;

     *) f_error;;
esac